Bug 2507059 (CVE-2026-64358) - CVE-2026-64358 kernel: media: mtk-jpeg: cancel workqueue on release for supported platforms only
Summary: CVE-2026-64358 kernel: media: mtk-jpeg: cancel workqueue on release for suppo...
Keywords:
Status: NEW
Alias: CVE-2026-64358
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-25 10:02 UTC by OSIDB Bzimport
Modified: 2026-07-29 22:14 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-25 10:02:54 UTC
In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: cancel workqueue on release for supported platforms only

Since a recent fix the mtk_jpeg_release function cancels any pending
or running work present in the driver workqueue using
cancel_work_sync function.
Currently, only the multicore based variants use this workqueue and they
have the jpeg_worker platform data field initialized with a workqueue
callback function. For the others, this field value remain NULL by
default.
The cancel_work_sync function is unconditionally called in
mtk_jpeg_release function, even for the variants that do not use the
workqueue. This call generates a WARN_ON print in __flush_work because
the workqueue callback function presence check fails in __flush_work
function (used by cancel_work_sync).

So, to avoid these warnings, call cancel_work_sync only if a workqueue
callback is defined in platform data.

Comment 1 Mauro Matteo Cascella 2026-07-29 22:11:01 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072520-CVE-2026-64358-2728@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.